syslog is a standard for logging messages about the operation of a system.
1
vote
1answer
216 views
CentOS - rsyslog and PHP - Log to remote, centralized server
I'm working on a project with a small number of servers which host a PHP application. Right now each server is currently logging php errors, locally, to /var/log/php/oops.log, but I would like ...
2
votes
2answers
128 views
Preferred method for allowing unprivileged UNIX/Linux users to view syslog information
I have some non-privileged "role accounts" that need the ability to view [some of] the local syslogs (eg. /var/log/messages) for debugging purposes.
This is explicitly local log data, not remote ...
2
votes
1answer
125 views
Disk / system configuration for log collection / syslog server
I am looking into building a syslog / logging infrastructure and am pondering about some architecture best practices. Essentially, I see that a syslog system needs to support two conflicting ...
1
vote
1answer
237 views
Ubuntu syslog: After log rotation nothing is written on /var/log/syslog
I've been running a Ubuntu VPS for a few weeks now, so a couple of monthly log rotations took place yestarday. For things like /var/log/wtmp things look as expected: logfile has recent entries, while ...
2
votes
0answers
53 views
Why don't cfn-init logs get sent by rsyslog?
I just signed up for Papertrail to aggregate logs from some AWS instances I'm setting up with CloudFormation::Init. I've followed the instructions and added *.* @logs.papertrailapp.com to the end of ...
1
vote
2answers
394 views
Forward Windows Events Logs to Rsyslog
I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on.
Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
3
votes
1answer
117 views
Log centralization, display, transport and aggregation at scale v2 [duplicate]
Possible Duplicate:
Log transport and aggregation at scale
This is a duplicate question of Log transport and aggregation at scale and ...
6
votes
1answer
169 views
Syslog produces hundreds of lines
I have recently been "promoted" to lab admin, as I have the most experience with linux. My logcheck keeps sending me emails with hundreds of lines stemming from my syslog file. It repeats itself over, ...
0
votes
1answer
140 views
Why isn't /var/log/maillog written with sync option by default?
Some syslog implementations on linux (sysklogd, rsyslog) include the following line in their default configuration:
mail.* -/var/log/maillog
As far as I know the dash sign means that it is not ...
4
votes
3answers
228 views
Ubuntu 10.04 syslog not logging to correct file
In a similar vein to Why is Syslog Not Writing Logs To The Designated Files?
I'm having a few problems with syslog on Ubuntu 10.0.4
I have an app which I have set to facility local7. I added the ...
0
votes
1answer
61 views
Syslog-ng prepends <[0-9]+> to my messages
I'm writing some parsing logic for syslog-ng messages and am noticing that for many of the commands syslog-ng prepends a <[0-9]+> string to most of my messages.
Here is an example from me ...
0
votes
1answer
427 views
/var/log/messages spammed with POLLERR messages
I've started seeing /var/log/messages growing in size indefinitely with these lines:
Aug 1 12:47:27 linux-jblp syslog-ng[1947]: POLLERR occurred while idle; fd='16'
Process 1947 is this:
root ...
0
votes
1answer
207 views
Amavisd-new cannot start - missing Unix::Syslog (CentOS)
I followed the basic instructions here for installing amavisd, spamassassin +
clamav...
http://wiki.centos.org/HowTos/Amavisd
I get the following error when trying to start amavisd...
# service ...
1
vote
2answers
503 views
Squid logging to syslog-ng - program name has brackets
Using Ubuntu 10.04.4 LTS and Squid3 I want to log to syslog-ng
Edited /etc/squid3/squid.conf and added the following line:
access_log syslog squid
Logs are being written but the program name ...
3
votes
1answer
3k views
rsyslog not logging messages
i'm attempting to set up my ec2 instance (running amazon linux which as i understand is built on RHEL 5) to forward log messages to loggentries.com but nothing is getting forwarded. as a sanity check ...
6
votes
2answers
1k views
Deciphering continuing mpt2sas syslog messages
Summary
I have been getting these cryptic messages in syslog since I installed some new hardware and I can't figure out what the problem is, if it's serious, or what to do about it.
They're from the ...
0
votes
1answer
207 views
Configuring 'audit' facility in syslog-ng on solaris server?
This is a follow-up to this question. mghocke was kind enough to help me out with that question, but this is really a separate question, therefor a new post.
I really don't know a lot about syslog, ...
2
votes
1answer
318 views
Moving from syslog.conf to syslogng.conf
I'm moving a Solaris box from syslogd to syslog-ng, because the Solaris version of syslogd obliterates the original source hostname on the logs. I'm looking through the syslogng.conf documentation, ...
0
votes
0answers
127 views
Expression-Based Filters not working in rsyslog
Probably a Quick one.
What is wrong with my syntax in this statement? rsyslog keeps complaining.
if $fromhost-ip == "172.16.255.3" and $programname == "named" then /syslogs/named.log
in logs when ...
1
vote
3answers
336 views
Does this log indicate the server reboooted?
I have a webserver I think rebooted at some point .. mostly because apache wasn't serving sites and it usually does that when someone starts it and doesn't enter the SSL cert's password ... and a ...
1
vote
2answers
143 views
Alternative solution to replace aging swatch
We are using swatch installation to sort through 3-5 gig worth of networking syslog and alert us on patterns , we are using splunk to index and search the data but splunk alerting capabilities are ...
1
vote
1answer
86 views
cisco syslog host dns
When I tell my Cisco router (IOS) to
(config)# logging syslog.mydomain.com
and then look at the config, the config contains the IP of syslog.mydomain.com, i.e. 1.2.3.4.
Now the whole purpose of ...
0
votes
1answer
1k views
How to log to /var/log/messages on Debian Squeeze as normal user?
In Ubuntu I could do something like:
sudo echo something | logger -t logstuff
Then I would get well formatted message in syslog (/var/log/messages). On Debian Squeeze that isn't the case, the above ...
1
vote
1answer
46 views
Syslog message '^@' indicates server crash
The php-cgi's died on a vps I look after and the only syslog entry is this followed by me restarting the VM:
...
0
votes
1answer
162 views
How to process, transform and re-send 1000req/sec log entries from syslogd?
I currently have two machines that receive about 1000 HTTP req/sec both and generate a log entry on every request. This log is centralized on a syslog daemon running on a different machine.
For ...
1
vote
1answer
148 views
Rsyslog Discarding Unwanted Messages
Once again, i found that Rsyslog is not as flexible as i expected...
My application logs to LOCAL5.* ( depending on the severity )
I would like to see on my centralized log server only ...
1
vote
2answers
380 views
Why aren't Heroku syslog drains logging to rsyslogd?
I'm having a problem using syslog drains as described in https://devcenter.heroku.com/articles/logging.
To summarize, I have an Ubuntu 10.04 instance on EC2 that is running rsyslogd. I've also set ...
1
vote
2answers
368 views
Postfix logs missing information on delivery status (postfix/smtp message)
I noticed a problem with postfix logs, that information on some of emails delivery status is missing. The issue affects about 1% of emails.
"Healthy" log:
<server># grep 8EB992EFBB44 ...
0
votes
0answers
117 views
How to stop Cisco CUCM 8.6 syslog messages?
I turned on debugs for a short while to get some data from our CUCM cluster and I cannot get them to stop. I have turned them off using Serviceability and also stopped and restarted the syslog service ...
1
vote
1answer
327 views
HAProxy running in chroot jail is only logging started messages
I've configured my HAProxy server to run in a chroot jail logging messages to syslog socket. My problem is that the only messsages currently being logged are for when haproxy is starting up.
May 26 ...
0
votes
1answer
417 views
syslog written on console
I have odd problem with syslog local7, my syslog configure the syslog to be written to
local7.info /var/log/syslog_info
it's working just fine for years but recent days one device syslog message ...
3
votes
1answer
426 views
Best Practices for rotating syslog logs on RHEL with different schedules?
OS:
Running RHEL 5.6.
Situation:
I need to rotate /var/log/messagees on a different schedule than the rest of the syslog logs.
By default syslog logs are rotated weekly based on the ...
-1
votes
2answers
286 views
Can it be because of any Kernel Bugs?specifically spin lock
We are running ubuntu 11.04 with 2.6.38-13-generic kernel on
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz with 48 GB RAM dedicated server with Hardware RAID.
top command output is showing many kernel ...
3
votes
1answer
677 views
Can a hostname be added to syslog-ng?
How can syslog-ng be configured to send both the hostname and the IP address. Currently, logs are sent with the IP address of the device/machine, but we want to add the hostname so I could keep my ip ...
2
votes
2answers
423 views
VMware: Is my SYSLOG Collector running?
I am trying to determine if my Syslog Collector I just set up in vCenter 5 is working correctly.
According to this VMware KB article and this VMware blog article, everything seems to be up and ...
1
vote
2answers
2k views
Apache httpd: Send error logs to syslog and local disk? Without touching /etc/syslog.conf?
I have an Apache httpd 2.2 server. I want to log all messages using syslog, so that the requests are sent to our central syslog server. I also want to ensure that all log messages are sent to local ...
1
vote
2answers
2k views
rsyslog: How do I direct messages from all remote machines to one file?
We have a syslog server and we have all our servers logging to it.
We want a sort of "catch-all" drippan rule for all remote messages that we have not configured a rule for.
Anyone know how to ...
2
votes
3answers
1k views
rsyslogd: Any way to get around the number of local facilities?
We have about 9-10 appliances we want to direct the logging to our rsyslog server for. However, there's only 8 local facilities (0-7). How can we get around this limitation?
0
votes
2answers
95 views
What is the “facility” of SnapGear SG560 System Log Syslog
My SnapGear (now McAfee) SG560 (firmware Version 4.0.10) has a "remote system log" feature, which can send syslog-type data to a host in my network. It's working, but writing to /var/log/messages. I'd ...
5
votes
1answer
809 views
How to maintain the log source host using logstash
I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter.
In the ...
2
votes
1answer
441 views
syslog writing to general instead of specific file
I'm running Ubuntu and Postgresql 9.
I've enabled postgresql to log to syslog, and added the following directive to the config file:
syslog_facility = 'local0'".
I've tried to configure syslog ...
1
vote
1answer
240 views
Additional Security Measures for Syslog over SSH
I'm currently working on setting up some secure syslog connections between a few Fedora servers. This is my currently setup
192.168.56.110 (syslog-server) <----> 192.168.57.110 (syslog-agent)
...
0
votes
1answer
191 views
On Solaris, how to log IP when using winbind auth and invalid user?
This is on Solaris 10 sparc platform.
I'm trying to make our denyhosts script block the dictionary ssh attacks.
Unfortunately, the logging does not show an IP when the user name is invalid.
We are ...
2
votes
3answers
1k views
How to stop syslog from listening to 514 on CentOS 5.8
I have a CentOS 5.8 machine (with regular syslog) that for some reason is listening to port 514, even though it is not started with "-r" (to receive remote syslog messages).
# netstat -tulpn | grep ...
2
votes
2answers
809 views
Increase rsyslog/syslog precision to include fractional seconds?
I use syslog and rsyslog to handle logging on my Linux & FreeBSD systems.
The timestamp is currently in seconds but I would like to increase the precision of these timestamps to include ...
0
votes
0answers
162 views
Push and Pull logging design - experience with processing sucked logs
I like the idea of combination of send (sending to syslog aggregator) and fetch (fetching logs from clients) design.
(More in wonderful doc ...
1
vote
2answers
1k views
Syslog-ng: how to change a message before sending to a remote host
I'm using syslog-ng 1.6.8 on SLES 10. From this machine, I need to forward all events to the remote host 10.30.38.115. But preliminary I have to change messages a little bit, adding "MyMark" prefix to ...
0
votes
1answer
237 views
Opensource log correlation application - an alternative to SEC?
is there a opensource log correlation application? I know only SEC[1]. The best would be if the application could work in clustered setup and would understand even structured logs, not only free-text ...
0
votes
1answer
69 views
syslog - log line classifications [closed]
A very generic question; in the context of a programmer, with operational aspect of the process (program) in mind.
Is there any sort of best-practice / guide to classify messages, particularly in the ...
2
votes
3answers
425 views
Syslog severity levels when to use Alert vs Critical
Short overview: Is Alert more severe than Critical.
RFC 5424 briefly defines syslog severity levels and gives a short description. Each syslog level is given a code 0 - 7. It was my understanding ...
